Please help w/ virus removal- logs incl

[cherrykoolaid80]

Hello, I have a virus that is preventing me from doing searches on google and yahoo, it opens several invisible internet explorer windows, and plays what I think are satellite radio programs at random times (including the playboy channel- woohoo). I have tried many tactics to delete the bad files, but it keeps coming back. Please help if you can! Thanks!

Here are my Malwarebytes and Hijackthis logs:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:08:27 PM, on 7/26/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\schtasks.exe

C:\Windows\System32\rundll32.exe

C:\hp\support\hpsysdrv.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Program Files\CyberLink\Shared Files\brs.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Windows\system32\jusched.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Internet Explorer\Iexplore.exe

C:\Program Files\Internet Explorer\Iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O1 - Hosts: 70.38.19.201 www.review.2009softwarereviews.com

O1 - Hosts: 70.38.19.201 review.2009softwarereviews.com

O1 - Hosts: 70.38.19.201 a1.review.zdnet.com

O1 - Hosts: 70.38.19.201 www.d1.reviews.cnet.com

O1 - Hosts: 70.38.19.201 www.reviews.toptenreviews.com

O1 - Hosts: 70.38.19.201 reviews.toptenreviews.com

O1 - Hosts: 70.38.19.201 www.reviews.download.com

O1 - Hosts: 70.38.19.201 reviews.download.com

O1 - Hosts: 70.38.19.201 www.reviews.pcadvisor.c.uk

O1 - Hosts: 70.38.19.201 reviews.pcadvisor.co.uk

O1 - Hosts: 70.38.19.201 www.reviews.pcmag.com

O1 - Hosts: 70.38.19.201 reviews.pcmag.com

O1 - Hosts: 70.38.19.201 www.reviews.pcpro.co.uk

O1 - Hosts: 70.38.19.201 reviews.pcpro.co.uk

O1 - Hosts: 70.38.19.201 www.reviews.reevoo.com

O1 - Hosts: 70.38.19.201 reviews.reevoo.com

O1 - Hosts: 70.38.19.201 www.reviews.riverstreams.co.uk

O1 - Hosts: 70.38.19.201 reviews.riverstreams.co.uk

O1 - Hosts: 70.38.19.201 www.reviews.techradar.com

O1 - Hosts: 70.38.19.201 reviews.techradar.com

O1 - Hosts: 70.38.19.201 d1.reviews.cnet.com

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [sunJavaUpdateReg] "C:\Windows\system32\jureg.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"

O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"

O4 - HKLM\..\Run: [bDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Office\AppData\Local\MICROS~1\Windows\TEMPOR~1\ANTIPH~1.SH! C:\Users\Office\AppData\Local\MICROS~1\Windows\TEMPOR~1\VIRTUA~1.SH!

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\office\appdata\local\temp\E4J5E3~1.SH! c:\users\office\appdata\local\temp\E4J4B5~1.SH! c:\users\office\appdata\local\temp\E4J26B~1.SH! c:\users\office\appdata\local\temp\E4J633~1.SH! c:\users\office\appdata\local\temp\E4J64B~1.SH! c:\users\office\appdata\local\temp\TEMPOR~1\Content.SH! c:\users\office\appdata\local\temp\TEMPOR~1.SH! c:\users\office\appdata\local\temp\History\History.SH! c:\users\office\appdata\local\temp\History.SH! c:\users\office\appdata\local\temp\Cookies.SH! c:\users\office\appdata\local\temp\E4J9B9~1.SH! c:\users\office\appdata\local\temp\E4J552~1.SH! C:\Users\Office\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\INT13YG9\HOT_1_~1.SH! c:\users\office\appdata\local\temp\E4J11E~1.SH! c:\users\office\appdata\local\temp\E4JEAF~1.SH! c:\users\office\appdata\local\temp\E4J9C0~1.SH! c:\users\office\appdata\local\temp\E4JAC0~1.SH! c:\users\office\appdata\local\temp\E4J2D2~1.SH! c:\users\office\appdata\

O4 - HKUS\S-1-5-18\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Office\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Office\AppData\Local\Temp\E4J283~1.SH! C:\Users\Office\AppData\Local\Temp\E4J249~1.SH! C:\Users\Office\AppData\Local\Temp\E4J49C~1.SH! C:\Users\Office\AppData\Local\Temp\E4J64F~1.SH! C:\Users\Office\AppData\Local\Temp\E4J1BF~1.SH! C:\Users\Office\AppData\Local\Temp\E4J898~1.SH! C:\Users\Office\AppData\Local\Temp\Low\HSPERF~1.SH! C:\Users\Office\AppData\Local\Temp\E4JCCA~1.SH! C:\Users\Office\AppData\Local\Temp\E4J6EE~1.SH! C:\Users\Office\AppData\Local\Temp\E4JED0~1.SH! C:\Users\Office\AppData\Local\Temp\E4JA11~1.SH! C:\Users\Office\AppData\Local\Temp\E4J9A4~1.SH! C:\Users\Office\AppData\Local\Temp\E4JBF0~1.SH! C:\Users\Office\AppData\Local\Temp\E4J6F2~1.SH! C:\Users\Office\AppData\Local\Temp\E4JF97~1.SH! C:\Users\Office\AppData\Local\Temp\E4JA24~1.SH! C:\Users\Office\AppData\Local\Temp\E4J7C7~1.SH! C:\Users\Office\AppData\Local\Temp\E4JB99~1.SH! C:\Users\Office\AppData

O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\office\appdata\local\temp\E4J5E3~1.SH! c:\users\office\appdata\local\temp\E4J4B5~1.SH! c:\users\office\appdata\local\temp\E4J26B~1.SH! c:\users\office\appdata\local\temp\E4J633~1.SH! c:\users\office\appdata\local\temp\E4J64B~1.SH! c:\users\office\appdata\local\temp\TEMPOR~1\Content.SH! c:\users\office\appdata\local\temp\TEMPOR~1.SH! c:\users\office\appdata\local\temp\History\History.SH! c:\users\office\appdata\local\temp\History.SH! c:\users\office\appdata\local\temp\Cookies.SH! c:\users\office\appdata\local\temp\E4J9B9~1.SH! c:\users\office\appdata\local\temp\E4J552~1.SH! C:\Users\Office\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\INT13YG9\HOT_1_~1.SH! c:\users\office\appdata\local\temp\E4J11E~1.SH! c:\users\office\appdata\local\temp\E4JEAF~1.SH! c:\users\office\appdata\local\temp\E4J9C0~1.SH! c:\users\office\appdata\local\temp\E4JAC0~1.SH! c:\users\office\appdata\local\temp\E4J2D2~1.SH! c:\users\office\appdata\

O4 - HKUS\.DEFAULT\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Office\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Office\AppData\Local\Temp\E4J283~1.SH! C:\Users\Office\AppData\Local\Temp\E4J249~1.SH! C:\Users\Office\AppData\Local\Temp\E4J49C~1.SH! C:\Users\Office\AppData\Local\Temp\E4J64F~1.SH! C:\Users\Office\AppData\Local\Temp\E4J1BF~1.SH! C:\Users\Office\AppData\Local\Temp\E4J898~1.SH! C:\Users\Office\AppData\Local\Temp\Low\HSPERF~1.SH! C:\Users\Office\AppData\Local\Temp\E4JCCA~1.SH! C:\Users\Office\AppData\Local\Temp\E4J6EE~1.SH! C:\Users\Office\AppData\Local\Temp\E4JED0~1.SH! C:\Users\Office\AppData\Local\Temp\E4JA11~1.SH! C:\Users\Office\AppData\Local\Temp\E4J9A4~1.SH! C:\Users\Office\AppData\Local\Temp\E4JBF0~1.SH! C:\Users\Office\AppData\Local\Temp\E4J6F2~1.SH! C:\Users\Office\AppData\Local\Temp\E4JF97~1.SH! C:\Users\Office\AppData\Local\Temp\E4JA24~1.SH! C:\Users\Office\AppData\Local\Temp\E4J7C7~1.SH! C:\Users\Office\AppData\Local\Temp\E4JB99~1.SH! C:\Users\Office\AppData

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O13 - Gopher Prefix:

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 12329 bytes

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Malwarebytes' Anti-Malware 1.39

Database version: 2421

Windows 6.0.6001 Service Pack 1

7/26/2009 5:15:45 PM

mbam-log-2009-07-26 (17-15-45).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 227226

Time elapsed: 37 minute(s), 58 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

[miekiemoes]

Hi,

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

Extra note: The combofix tutorial recommends to disable your Antivirus, in your case McAfee. For McAfee, I rather recommend to temporary uninstall it, because Mcafee causes a lot of problems with Combofix after reboot, this because McAfee enables again after reboot. So please temporary uninstall McAfee first, then reboot and then scan with Combofix.

[cherrykoolaid80]

I have downloaded combofix and when I click to run the program it asks about the unknown publisher. I choose to run it, but then nothing happens. I have disabled/removed all antivirus programs as instructed.

ps- cute dog!

[miekiemoes]

Strange..

Combofix should run though..

Please remove the Combofix from your desktop and try the following method...

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Tools->Options->Main tab
     
   • Set to "Always ask me where to Save the files".
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

If you still cannot get this to run, try booting into Safe Mode, and run it there.

To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode."

[cherrykoolaid80]

combofix log:

ComboFix 09-07-26.03 - Office 07/27/2009 11:08.1.2 - NTFSx86

Microsoft

[cherrykoolaid80]

please advise whether i can reinstall mcafee

[miekiemoes]

Hi,

Don't install McAfee now, we are not finished yet...

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

File::

C:\Windows\system32\drivers\gaopdxmcmtrwqjonbrhaywsbdaaxxokxqnipdp.sys

Driver::

gaopdxserv.sys

Registry::

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"InternetSettingsDisableNotify"=dword:00000000

"UacDisableNotify"=dword:00000000

"AutoUpdateDisableNotify"=dword:00000000

REGLOCKDEL::

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gaopdxserv.sys]

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

[cherrykoolaid80]

ComboFix 09-07-26.03 - Office 07/27/2009 11:41.2.2 - NTFSx86

Microsoft

[miekiemoes]

Hi,

This looks OK again.

* Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

[cherrykoolaid80]

Hi, everything looks ok as far as I can tell. I am able to get results from a google search now, that's the main thing I was having a problem with.

Is it normal to have 3 iexplorer's open in task manager if I only have 1 window open? Before when music would randomly start I could go into task manager and close the extra (hidden) iexplorer processes to stop it. That is the only thing I am unsure about. No music is playing now but I do have the several processes running.

[miekiemoes]

Hi,

Is it normal to have 3 iexplorer's open in task manager if I only have 1 window open?

Yes, that's normal in IE8. This because tabs are a new instance of iexplore.exe. This wasn't the same in IE7.

Also see here: http://www.winhelponline.com/blog/multiple...net-explorer-8/

Glad I could help.

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!

[miekiemoes]

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.